Amendments to the Claims: 

This listing of claims will replace all prior versions, and listings, of claims in the application: 

Listing of Claims: 

1 . (Currently Amended) A method of detecting a denial of service attack at a network server, 
comprising: th e st e ps of 

counting [[the]] a number of inbound packets and [[the]] a number of discarded packets [[X]] in a 
specified interval, 

responsive to [[if]] the number of discarded packets [[X]] in the specified interval [[exceeds]] 
exceeding a specified minimum X(MIN) , [[then]] calculating [[the]] a percentage of discarded packets! R 
=^-X wherein the percentage of discarded packets is the number of discarded packets divided by the 
number of inbound packets, and 

responsive to the percentage of discarded packets exceeding if R e xce e ds a specified threshold, 
[[then]] setting a denial of service event marker. 

2. (Currently Amended) The method of claim l 1 further comprising: th e s t e p of 

collecting r e l e vant inbound packet information to further characterize the denial of service attack. 

3 . (Currently Amended) The method of claim 2 1 wherein th e st e p of collecting the r e l e vant inbound 
packet information further comprises: 

initiating a flood monitoring process that is executed at designated a sp e cifi e d intervals to collect 
the r e l e vant inbound packet information while the denial of service attack is in progress. 

4. (Currently Amended) The method of claim 3 a wherein the flood monitoring process comprises: 
resetting the denial of service event marker if the number of discarded packets in the specified 

interval before execution of the flood monitoring process is lower than a second specified minimum. 
X(MIN2), whoroin X(MIN2) may or may not e qual X(MIN). 

5. (Currently Amended) The method of claim 3^ wherein the flood monitoring process comprises: 
resetting the denial of service event marker if [[the]] a rate of discarded packets in the specified 

interval before execution of the flood monitoring process is less than a second specified threshold. 
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6. (Currently Amended) The method of claim 4 A or claim 5 further comprising: th e furth e r st e p of 
collecting the r e l e vant inbound packet information to further characterize the denial of service 

attack when the denial of service attack is declared over. 

7. (Currently Amended) The method of claim 6 A wherein the coll e ct e d inbound packet information 



a) [[the]] a number of inbound packets in [[the]] a last interval; 

b) [[the]] a number of discarded packets in [[the]] a last interval; 

c) [[the]] a packet discard rate; 

d) [[the]] a most frequent discard protocol type; 

e) [[the]] a most frequent discard di s card type; and 

0 [[the]] a media access control (MAC) address of [[the]] an immediately prior packet hop. 

8. (Currently Amended) The method of claim 3 1 wherein the flood monitoring process comprises: 
determining if the [[flood]] denial of service attack is still in progress by comparing [[the]] 

packets discarded in [[the]] a last interval with the number of inbound packets, and 

maintaining th e sch e duling of the flood monitoring process if the denial of service attack is still in 
progress. 

9. (Currently Amended) The method of claim 8 A further comprising: 
collecting rel e vant inbound packet information for the last interval. 

10. (New) The method of claim 5, further comprising: 

collecting additional inbound packet information to further characterize the denial of service 
attack when the denial of service attack is declared over. 
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